Struct SeccompFilter 

pub struct SeccompFilter {
    pub instructions: Vec<BpfInstruction>,
    pub inherit_on_fork: bool,
    pub filter_id: u64,
}

A seccomp BPF filter program.

Fields

instructions: Vec<BpfInstruction>

BPF instructions.

inherit_on_fork: bool

Whether this filter should be inherited on fork.

filter_id: u64

Filter ID for tracking.

Implementations

impl SeccompFilter

pub fn new() -> Self

Create a new empty filter.

pub fn push(&mut self, insn: BpfInstruction)

Add an instruction to the filter.

pub fn len(&self) -> usize

Get the number of instructions.

pub fn is_empty(&self) -> bool

Check if the filter is empty.

pub fn validate(&self) -> Result<(), KernelError>

Validate the filter program.

pub fn evaluate(&self, data: &SeccompData) -> u32

Execute the filter against a seccomp_data structure. Returns the action (SeccompAction value | errno).

pub fn deny_syscalls(arch: u32, denied: &[u32], errno_val: u16) -> Self

Build a filter that checks architecture and denies a set of syscall numbers.

pub fn allow_syscalls(arch: u32, allowed: &[u32]) -> Self

Build a filter that only allows a whitelist of syscalls.

Trait Implementations

impl Clone for SeccompFilter

fn clone(&self) -> SeccompFilter

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SeccompFilter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SeccompFilter

Available on crate feature alloc only.

fn default() -> Self

Returns the “default value” for a type.